Extracted

• • Target

    New order.exe

  • Size

    1.0MB

  • MD5

    cc0e7f78f732294205367b63c08b112f

  • SHA1

    2994128f0369ad6fb19c2b70b10d1150126718f1

  • SHA256

    1ddb5066864496c4fdb477252d09eee2f3304d5801c93bc9a72acb22eb78523b

  • SHA512

    1f2f2a93354b467eada7729c10a7e40b54073d484dd18ee64f04a88d6bdb9672cbbb6e998b671c54c3dceb306c6ff01ce3ca74681f7dadc280e6ce00f6fe88d7

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLgssNh4LygQJgrmCeYdc00c:f3v+7/5QLgL7lJgr5N9

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2